Anthropic Explains How Claude's Watermark Works — Sparse in Code and Proofreading, Full in Translation

Anthropic published a document on August 14, 2026 explaining how Claude’s text watermark works ¹. Where the support document we covered on August 13 laid out policy — what is covered, from when, and where — this one is about the mechanism, and about the places where that mechanism does not take hold.

Anthropic opens with six points ¹: no practical impact on quality or content; watermarked and un-watermarked text indistinguishable to readers; nothing added to the text and no hidden characters; no extra tokens and no higher price; no identifying information and no traceability to a person, organization, or chat; and this is not specific to Claude, since other major model developers signed the same Code of Practice and will implement their own watermarks ¹.

Changing the Randomness, Not the Words

The core of the explanation is what the watermark does not change. Language models generate one word at a time, each time picking from a list of candidates the one that is most sensible given the preceding text ¹. After “The weather today was cold and…”, the next word is very unlikely to be “sugary” but quite likely to be “overcast” or “grey.” To a reader it hardly matters which of those two is chosen, and in cases like that the choice is settled by a random number ¹.

The watermark intervenes in exactly those low-stakes choices ¹. But rather than steering the choice, it changes where the randomness comes from. Instead of an arbitrary random number generator, the key and a few preceding words settle what word the model picks ¹. The words still look random, but anyone holding the key can check whether the sequence is consistent with the choices Claude would make using that key — and if it is, assign a probability that the text was generated by Claude ¹.

Anthropic is careful to note this does not bias the model toward particular words ¹. “Overcast” might be selected in one sentence and “grey” in the next, just as without watermarking, and the method does not push Claude toward a word it would not have considered anyway ¹. The analogy the company uses is playing Monopoly with digits of pi instead of dice rolls ¹. Nothing changes for the players or the outcome, but reviewing the sequence of moves afterward reveals whether the game likely used pi ¹.

The method is not Anthropic’s invention. It is a version of the SynthID-Text approach Google DeepMind published in a Nature paper in 2024, itself part of a family going back to a 2022 proposal by Scott Aaronson ¹. All of them share the design principle that only the source of randomness changes ¹.

Thin on Factual Text, Code, and Proofreading

The limitations are the part that matters most in practice.

Using the key answers only one question: how likely is it that this was partly written by Claude ¹. It does not confirm that text was human-written, and it cannot tell whether a different AI wrote it — another AI’s watermark would use a different key, and possibly a different method entirely ¹. Detection also works poorly on small samples, where there are fewer word choices and less information to go on; confidence rises as a passage gets longer ¹.

And the less room there is to phrase something differently, the thinner the watermark gets ¹. Anthropic’s example is the sentence “Isaac Newton’s most famous work was called…”, where it really matters that the next word is “Principia” — there is only one right answer, so the watermark has nothing to act on ¹.

The same logic applies to code. Where an exact output is required — where a different term would make something factually wrong or break the code — the watermark is not applied ¹. Once the model has written “2 + 2 =”, there is a clear best next token, and the watermark’s “nudge” does not apply there ¹. Because code very often has to be exact, it generally carries less watermarking than other forms of text ¹. Where an arbitrary choice between terms does exist within code — comments, for instance — the watermark can be used ¹, though by definition that has a negligible effect on the code actually produced ¹.

Proofreading behaves the same way ¹. The watermark only applies to words Claude chooses. When Claude proofreads a person’s writing, what comes back has generally been only lightly edited, so there is very little for the watermark to attach to ¹. Depending on length and how heavily Claude edited, those changes may not be enough to make Claude’s involvement detectable ¹. As Anthropic puts it, the more Claude writes, the more decisions it makes, and the more space there is for a watermark ¹.

Translations, by contrast, do carry the watermark ¹, because every word is chosen by Claude ¹. On whether editing removes it, the answer is “to some extent”: light editing probably will not remove it completely, while a complete rewrite replacing every word will ¹ — though in that case, Anthropic adds, it is arguable whether the text can still be called AI-generated ¹.

What a detection result proves is also bounded. A watermark can only establish that Claude was likely involved at some point; it cannot distinguish “Claude wrote this” from “Claude heavily edited this” ¹. That limit appeared in the earlier article too, but here the reason for it comes from the mechanism itself.

Speed, Price, and Tracing

Anthropic addresses the obvious concerns directly.

On speed and cost, watermarking has a negligible impact on model speed, and because it produces no extra tokens, the model costs the same to serve and to use ¹. On tracing, the watermark applies to Claude and its outputs, not to individual users ¹. Nothing in the watermark or its key would let anyone recover information about a user, their organization, or their chats with Claude ¹.

Rights are unchanged as well. The watermark only helps test whether Claude might have produced or processed the content; it says nothing about ownership or authorship and does not change a user’s rights under Anthropic’s terms ¹.

On quality, internal testing showed no impact on the content, level of creativity, or readability of Claude’s text ¹. As supporting evidence, Anthropic cites the Nature paper: Google DeepMind served a watermarked model to a portion of Gemini traffic and compared thumbs-up and thumbs-down ratings, finding no statistically significant differences from the unwatermarked model, and a controlled study where human raters comparing answers side by side saw no difference in quality ¹. Both are claims resting on Anthropic’s internal testing and DeepMind’s research.

Detection Is Still Pending

So how does anyone actually check? That part is not filled in yet. Anthropic says it will “soon be offering a watermark detection API” and that it is still working out the details of the implementation ¹.

It also contrasts this with existing AI detection software, which uses a different method because those companies do not have Anthropic’s key ¹. Those services look at “tells” in AI phrasing — Anthropic notes that AI models seem fond of the construction “this isn’t [X], it’s [Y]” and use the word “quietly” more than one might expect ¹. Picking up such patterns is fundamentally different from checking a watermark ¹.

Files are handled separately. When Claude produces a supported file type such as .png, .jpg, or .svg, it attaches a content credential — a small, cryptographically signed note in the file’s metadata saying the file was made or processed with Claude ¹. That is the C2PA open industry standard, the same one camera makers and photo-editing software use to record where an image came from, and any C2PA-aware tool can read it ¹. Anthropic says it will provide its own tool where a file can be dropped in and checked ¹. This is very different from a watermark: nothing in the file changes, and nothing is embedded or hidden ¹. When Suno set out its provenance plans for music, identification tooling and audio watermarking were likewise listed as separate efforts. Across text, image, and audio, “embedding a mark” and “recording provenance in metadata” remain two different things.

A Regulatory Response That Applies Worldwide

The reason for watermarking is the same as before: compliance with the EU AI Act ¹. Anthropic, along with several other major model providers and around 190 total signatories, signed the EU Code of Practice on Transparency of AI-Generated Content in July 2026 ¹. It requires AI system providers to use methods of “marking” AI-generated text ¹.

The global scope is explained too: Anthropic does not yet have a durable way to scope the watermark by region, so it applies worldwide at launch ¹. The company says it will keep evaluating different approaches and share updates ¹. Anthropic models launched before August 2, 2026 fall under a transition period in the law, and work to add watermarking to those models is underway, rolling out over the coming months ¹.

The same day, Google moved in what looks like the opposite direction. It announced a setting that lets users turn off the visible watermark on images, videos, and music made with Gemini, while stating that invisible SynthID watermarks and C2PA metadata always stay embedded. The visible mark becomes optional; the machine-readable one does not. Different directions, but the same design underneath — provenance kept in a layer readers do not see.

Until the detection API ships, the watermark will be present without any way to check it locally. For anyone on the verifying side — screening job applications, student work, or contracted deliverables — the more useful thing to know first is where it does not hold: code, short passages, and proofreading.